Sophos Firewall Integration with Wazuh SIEM

Sophos Firewall Integration with Wazuh SIEM

Overview

Integrating Sophos Firewall with Wazuh enables centralized log collection, enhanced visibility, and advanced threat detection. By forwarding firewall logs to Wazuh via Syslog, security teams can monitor network activity, detect anomalies, and respond to incidents more effectively.

This guide outlines the complete process of integrating a Sophos XG/XGS Firewall with the Wazuh SIEM platform.

Architecture

The integration follows a simple Syslog-based architecture:

• Sophos Firewall → Sends logs via Syslog (UDP/TCP 514)
• Wazuh Manager → Receives, decodes, and analyzes logs
• Wazuh Dashboard (Kibana/OpenSearch) → Visualizes events

01 — Architecture diagram

Prerequisites

Before starting, ensure the following:

• Sophos Firewall (XG/XGS series)
• Wazuh Manager installed and running
• Network connectivity between firewall and Wazuh server
• Open port 514 (UDP or TCP) on Wazuh Manager

Step 1: Configure Syslog on Sophos Firewall

Navigate to:

System Services → Log Settings → Syslog Servers

Add a New Syslog Server:

• Name: SIEM
• IP Address: 192.168.0.94 (Wazuh Manager IP)
• Port: 514
• Facility: DAEMON
• Severity Level: Debug
• Format: Standard syslog protocol

Ensure “Secure log transmission” is disabled unless TLS is configured.

Sophose Syslog Setting

Step 2: Enable Log Types for SIEM

Under Log Settings, configure which logs should be forwarded:

Recommended Log Selection:

• Firewall Rules ✅
• DoS Attacks ✅
• Dropped Packets ✅
• IP Spoofing ✅
• SSL VPN Events ✅
• Application Filtering Logs ✅

Enable logging under the SIEM column for relevant categories.

Sophose Firewall Logs Collection

Step 3: Syslog Server Configuration on Sophos Firewall

This configuration demonstrates the setup of a Syslog server on the Sophos Firewall to forward logs to the Wazuh SIEM platform.

In this step, a new Syslog server entry named “SIEM” is created, where the IP address (192.168.0.94) represents the Wazuh Manager. The firewall is configured to send logs over port 514, using the standard syslog protocol.

The facility is set to DAEMON, which categorizes system-level logs, while the severity level is configured as Debug to ensure detailed log collection for comprehensive monitoring and analysis.

Syslog server configuration

Step 4: Configure Wazuh Manager (ossec.conf)

Edit the Wazuh configuration file:

Remote connection setting in Wazuh to receving Sophose Logs via syslog

Explanation:

• connection: Defines Syslog input
• port: Listening port
• protocol: UDP (or TCP if configured)
• allowed-ips: Sophos Firewall IP
• local_ip: Wazuh Manager IP

Save this configuration file and restart wazuh-manager.

Step 5: Create Custom Decoder

Create a decoder file:

Sophose Firewall Decoders

<!--
device_name="SFW" timestamp="2026-04-1T00:04:20+0500" device_model="XGS4300" device_serial_id="X43018RQGWX3959" log_id="010102600002" log_type="Firewall" log_component="Firewall Rule" log_subtype="Denied" log_version=1 severity="Information" fw_rule_id="67" fw_rule_name="HO-AreaOffices-Internet" fw_rule_section="Local rule" nat_rule_id="0" fw_rule_type="USER" web_policy_id=49 app_filter_policy_id=35 ether_type="IPv4 (0x0800)" in_interface="Port8.29" src_mac="ce:1e:0c:77:af:4c" src_ip="192.168.29.28" src_country="R1" dst_ip="172.224.19.131" dst_country="IND" protocol="UDP" src_port=55332 dst_port=443 hb_status="No Heartbeat" app_resolved_by="Signature" app_is_cloud="FALSE" qualifier="New" in_display_interface="AreaOffices-in-HO" log_occurrence="1"
-->
<decoder name="sophose_firewall">
    <prematch>SFW</prematch>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>device_name="(\.*)"</regex>
    <order>device_name</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>timestamp="(\.*)"</regex>
    <order>timestamp</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>device_model="(\.*)"</regex>
    <order>device_model</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>device_serial_id="(\.*)"</regex>
    <order>device_serial_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>log_id="(\.*)"</regex>
    <order>log_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>log_type="(\.*)"</regex>
    <order>log_type</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>log_component="(\.*)"</regex>
    <order>log_component</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>log_subtype="(\.*)"</regex>
    <order>log_subtype</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>log_version=(\.*) </regex>
    <order>log_version</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>severity="(\.*)"</regex>
    <order>severity</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>fw_rule_id="(\.*)"</regex>
    <order>fw_rule_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>fw_rule_name="(\.*)"</regex>
    <order>fw_rule_name</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>fw_rule_section="(\.*)"</regex>
    <order>fw_rule_section</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>nat_rule_id="(\.*)"</regex>
    <order>nat_rule_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>fw_rule_type="(\.*)"</regex>
    <order>fw_rule_type</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>web_policy_id=(\.*) </regex>
    <order>web_policy_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_filter_policy_id=(\.*) </regex>
    <order>app_filter_policy_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>ether_type="(\.*)"</regex>
    <order>ether_type</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>in_interface="(\.*)"</regex>
    <order>in_interface</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_mac="(\.*)"</regex>
    <order>src_mac</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_ip="(\.*)"</regex>
    <order>src_ip</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_country="(\.*)"</regex>
    <order>src_country</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>dst_ip="(\.*)"</regex>
    <order>dst_ip</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>dst_country="(\.*)"</regex>
    <order>dst_country</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>protocol="(\.*)"</regex>
    <order>protocol</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_port=(\.*) </regex>
    <order>src_port</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>dst_port=(\.*) </regex>
    <order>dst_port</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>hb_status="(\.*)"</regex>
    <order>hb_status</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_resolved_by="(\.*)"</regex>
    <order>app_resolved_by</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_is_cloud="(\.*)"</regex>
    <order>app_is_cloud</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>qualifier="(\.*)"</regex>
    <order>qualifier</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>in_display_interface="(\.*)"</regex>
    <order>in_display_interface</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>log_occurrence="(\.*)"</regex>
    <order>log_occurrence</order>
</decoder>

<!-- Additional fields for enhanced rules -->

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_name="(\.*)"</regex>
    <order>app_name</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_risk=(\.*) </regex>
    <order>app_risk</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_technology="(\.*)"</regex>
    <order>app_technology</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>app_category="(\.*)"</regex>
    <order>app_category</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>duration=(\.*) </regex>
    <order>duration</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>bytes_sent=(\.*) </regex>
    <order>bytes_sent</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>bytes_received=(\.*) </regex>
    <order>bytes_received</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>packets_sent=(\.*) </regex>
    <order>packets_sent</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>packets_received=(\.*) </regex>
    <order>packets_received</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>user_name="(\.*)"</regex>
    <order>user_name</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>user_group="(\.*)"</regex>
    <order>user_group</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_zone_type="(\.*)"</regex>
    <order>src_zone_type</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_zone="(\.*)"</regex>
    <order>src_zone</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>dst_zone_type="(\.*)"</regex>
    <order>dst_zone_type</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>dst_zone="(\.*)"</regex>
    <order>dst_zone</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>con_event="(\.*)"</regex>
    <order>con_event</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>con_id="(\.*)"</regex>
    <order>con_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>out_interface="(\.*)"</regex>
    <order>out_interface</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>out_display_interface="(\.*)"</regex>
    <order>out_display_interface</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>dst_mac="(\.*)"</regex>
    <order>dst_mac</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>src_trans_ip="(\.*)"</regex>
    <order>src_trans_ip</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>gw_id_request=(\.*) </regex>
    <order>gw_id_request</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>gw_name_request="(\.*)"</regex>
    <order>gw_name_request</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>ips_policy_id=(\.*) </regex>
    <order>ips_policy_id</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>nat_rule_name="(\.*)"</regex>
    <order>nat_rule_name</order>
</decoder>

<!-- Content Filtering specific fields -->

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>url="(\.*)"</regex>
    <order>url</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>domain="(\.*)"</regex>
    <order>domain</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>http_category="(\.*)"</regex>
    <order>http_category</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>http_category_type="(\.*)"</regex>
    <order>http_category_type</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>http_status="(\.*)"</regex>
    <order>http_status</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>exceptions="(\.*)"</regex>
    <order>exceptions</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>used_quota="(\.*)"</regex>
    <order>used_quota</order>
</decoder>

<decoder name="sophose_firewall_child">
    <parent>sophose_firewall</parent>
    <regex>message="(\.*)"</regex>
    <order>message</order>
</decoder>

Save decoder with the name of file “sophose_decoder.xml” and restart wazuh-manager.

Step 6: Create Custom Rules

Create rules file:

Sophos Firewall Rules

<group name="sophose,">

    <!-- Base rule for all Sophos XG Firewall events -->
    <rule id="111000" level="0">
        <decoded_as>sophose_firewall</decoded_as>
        <description>Sophos XG Firewall event</description>
        <group>firewall,</group>
    </rule>

    <!-- BASELINE RULES (Level 1-2) - For data collection and baselining -->

    <!-- Baseline rule for all firewall events -->
    <rule id="111001" level="1">
        <if_sid>111000</if_sid>
        <field name="log_type">Firewall</field>
        <description>Sophos XG Firewall - $(log_type) event (baselining)</description>
        <group>firewall,baseline,</group>
    </rule>

    <!-- Baseline rule for content filtering events -->
    <rule id="111002" level="1">
        <if_sid>111000</if_sid>
        <field name="log_type">Content Filtering</field>
        <description>Sophos XG Content Filtering - $(log_type) event (baselining)</description>
        <group>firewall,content_filtering,baseline,</group>
    </rule>

    <!-- Baseline rule for Information severity events -->
    <rule id="111003" level="1">
        <if_sid>111000</if_sid>
        <field name="severity">Information</field>
        <description>Sophos XG - $(severity) severity event (baselining)</description>
        <group>firewall,info,baseline,</group>
    </rule>

    <!-- OPERATIONAL RULES (Level 3-5) - Normal operations -->

    <!-- Allowed connections -->
    <rule id="111010" level="3">
        <if_sid>111000</if_sid>
        <field name="log_subtype">Allowed</field>
        <description>Sophos XG - $(log_component): Connection allowed</description>
        <group>firewall,allowed,</group>
    </rule>

    <!-- Warning severity events -->
    <rule id="111011" level="4">
        <if_sid>111000</if_sid>
        <field name="severity">Warning</field>
        <description>Sophos XG - $(log_component): Warning event</description>
        <group>firewall,warning,</group>
    </rule>

    <!-- Denied connections - standard level -->
    <rule id="111012" level="2">
        <if_sid>111000</if_sid>
        <field name="log_subtype">Denied</field>
        <description>Sophos XG - $(log_component): Connection denied</description>
        <group>firewall,denied,</group>
    </rule>

    <!-- SECURITY EVENTS (Level 6-8) - Potential security issues -->

    <!-- Invalid Traffic events -->
    <rule id="111020" level="2">
        <if_sid>111000</if_sid>
        <field name="log_component">Invalid Traffic</field>
        <description>Sophos XG - Invalid traffic detected from $(src_ip) to $(dst_ip)</description>
        <group>firewall,invalid_traffic,security,</group>
    </rule>

    <!-- Appliance Access denied events -->
    <rule id="111021" level="6">
        <if_sid>111000</if_sid>
        <field name="log_component">Appliance Access</field>
        <field name="log_subtype">Denied</field>
        <description>Sophos XG - Appliance access denied from $(src_ip)</description>
        <group>firewall,appliance_access,denied,security,</group>
    </rule>

    <!-- Firewall rule denied with business/network type -->
    <rule id="111022" level="7">
        <if_sid>111012</if_sid>
        <field name="fw_rule_type">BUSINESS|NETWORK</field>
        <description>Sophos XG - $(fw_rule_type) firewall rule denied connection from $(src_ip) to $(dst_ip)</description>
        <group>firewall,denied,business_rule,security,</group>
    </rule>

    <!-- CRITICAL EVENTS (Level 9-12) - High priority security events -->

    <!-- Critical severity events -->
    <rule id="111030" level="10">
        <if_sid>111000</if_sid>
        <field name="severity">Critical</field>
        <description>Sophos XG - CRITICAL: $(log_component) event</description>
        <group>firewall,critical,</group>
    </rule>

    <!-- FREQUENCY RULES - Multiple events from same source -->

    <!-- Multiple denied connections from same source -->
    <rule id="111040" level="8" frequency="10" timeframe="300">
        <if_matched_sid>111012</if_matched_sid>
        <same_source_ip />
        <description>Sophos XG - Multiple denied connections ($(firedtimes)) from $(src_ip) in 5 minutes</description>
        <group>firewall,denied,multiple_attempts,</group>
    </rule>

    <!-- Multiple invalid traffic from same source -->
    <rule id="111041" level="9" frequency="5" timeframe="300">
        <if_matched_sid>111020</if_matched_sid>
        <same_source_ip />
        <description>Sophos XG - Multiple invalid traffic attempts ($(firedtimes)) from $(src_ip) in 5 minutes</description>
        <group>firewall,invalid_traffic,multiple_attempts,security,</group>
    </rule>

    <!-- COMPONENT-SPECIFIC RULES -->

    <!-- HTTP Content Filtering -->
    <rule id="111050" level="3">
        <if_sid>111000</if_sid>
        <field name="log_component">HTTP</field>
        <field name="log_subtype">Allowed</field>
        <description>Sophos XG - HTTP content filtering: $(url) allowed</description>
        <group>firewall,content_filtering,http,allowed,</group>
    </rule>

    <rule id="111051" level="5">
        <if_sid>111000</if_sid>
        <field name="log_component">HTTP</field>
        <field name="log_subtype">Denied</field>
        <description>Sophos XG - HTTP content filtering: $(url) denied</description>
        <group>firewall,content_filtering,http,denied,</group>
    </rule>

    <!-- PROTOCOL-SPECIFIC RULES -->

    <!-- DNS queries (common, low level for baselining) -->
    <rule id="111060" level="2">
        <if_sid>111000</if_sid>
        <field name="dst_port">53</field>
        <description>Sophos XG - DNS query from $(src_ip) to $(dst_ip) (baselining)</description>
        <group>firewall,dns,baseline,</group>
    </rule>

    <!-- SSH connections -->
    <rule id="111061" level="4">
        <if_sid>111000</if_sid>
        <field name="dst_port">22</field>
        <description>Sophos XG - SSH connection from $(src_ip) to $(dst_ip)</description>
        <group>firewall,ssh,</group>
    </rule>

    <!-- HTTPS connections -->
    <rule id="111062" level="2">
        <if_sid>111000</if_sid>
        <field name="dst_port">443</field>
        <description>Sophos XG - HTTPS connection from $(src_ip) to $(dst_ip)</description>
        <group>firewall,https,</group>
    </rule>

    <!-- High risk protocol connections -->
    <rule id="111063" level="6">
        <if_sid>111000</if_sid>
        <field name="dst_port">23|135|139|445|1433|3389</field>
        <description>Sophos XG - High risk protocol connection to $(dst_ip):$(dst_port)</description>
        <group>firewall,high_risk_protocol,security,</group>
    </rule>

    <!-- APPLICATION RISK RULES -->

    <!-- High risk applications (app_risk >= 2) -->
    <rule id="111064" level="5">
        <if_sid>111000</if_sid>
        <field name="app_risk">^[2-9]$|^[1-9][0-9]+$</field>
        <description>Sophos XG - High risk application detected: $(app_name) (risk level: $(app_risk))</description>
        <group>firewall,high_risk_app,security,</group>
    </rule>

    <!-- Social media and entertainment applications -->
    <rule id="111065" level="0">
        <if_sid>111000</if_sid>
        <field name="app_category">Mobile Applications|Social Networking|Entertainment</field>
        <description>Sophos XG - Social/Entertainment application: $(app_name)</description>
        <group>firewall,social_media,productivity,</group>
    </rule>

    <!-- DATA TRANSFER RULES -->

    <!-- Large data transfers (high bytes sent/received) -->
    <rule id="111070" level="4">
        <if_sid>111000</if_sid>
        <field name="bytes_sent">^[1-9][0-9]{6,}$</field>
        <description>Sophos XG - Large outbound data transfer: $(bytes_sent) bytes from $(src_ip) to $(dst_ip)</description>
        <group>firewall,data_transfer,large_upload,</group>
    </rule>

    <rule id="111071" level="4">
        <if_sid>111000</if_sid>
        <field name="bytes_received">^[1-9][0-9]{6,}$</field>
        <description>Sophos XG - Large inbound data transfer: $(bytes_received) bytes from $(dst_ip) to $(src_ip)</description>
        <group>firewall,data_transfer,large_download,</group>
    </rule>

    <!-- CONNECTION DURATION RULES -->

    <!-- Long duration connections (over 1 hour = 3600 seconds) -->
    <rule id="111072" level="4">
        <if_sid>111000</if_sid>
        <field name="duration">^[3-9][6-9][0-9][0-9]$|^[4-9][0-9]{3,}$|^[1-9][0-9]{4,}$</field>
        <description>Sophos XG - Long duration connection: $(duration) seconds from $(src_ip) to $(dst_ip)</description>
        <group>firewall,long_connection,monitoring,</group>
    </rule>

    <!-- GEOGRAPHIC RULES -->

    <!-- Connections to/from suspicious countries (can be customized) -->
    <rule id="111073" level="5">
        <if_sid>111000</if_sid>
        <field name="dst_country">CHN|RUS|PRK|IRN</field>
        <description>Sophos XG - Connection to potentially high-risk country: $(dst_country)</description>
        <group>firewall,geographic,high_risk_country,</group>
    </rule>

    <!-- USER ACTIVITY RULES -->

    <!-- Administrator user activity -->
    <rule id="111074" level="4">
        <if_sid>111000</if_sid>
        <field name="user_name">administrator@.*</field>
        <description>Sophos XG - Administrator user activity: $(user_name) from $(src_ip)</description>
        <group>firewall,admin_activity,monitoring,</group>
    </rule>

    <!-- ZONE-BASED RULES -->

    <!-- DMZ to LAN traffic (potentially suspicious) -->
    <rule id="111075" level="6">
        <if_sid>111000</if_sid>
        <field name="src_zone_type">DMZ</field>
        <field name="dst_zone_type">LAN</field>
        <description>Sophos XG - DMZ to LAN communication from $(src_ip) to $(dst_ip)</description>
        <group>firewall,dmz_to_lan,security,</group>
    </rule>

    <!-- WAN to LAN denied (expected, but good for monitoring) -->
    <rule id="111076" level="3">
        <if_sid>111012</if_sid>
        <field name="src_zone_type">WAN</field>
        <field name="dst_zone_type">LAN</field>
        <description>Sophos XG - WAN to LAN connection denied from $(src_ip) to $(dst_ip)</description>
        <group>firewall,wan_to_lan,denied,monitoring,</group>
    </rule>
    </group>

Save rules with the name of file “sophose_rules.xml” and restart wazuh-manager.

Step 8: Verify Logs in Wazuh Dashboard

Go to:

Wazuh Dashboard → Discover

You should start seeing logs like:

• Firewall rule denied connections
• HTTP/HTTPS filtering events
• Application traffic logs

Sophos XG Firewall logs in Wazuh Dashboard

Some Use Cases

• Detect unauthorized access attempts
• Monitor denied traffic and firewall rules
• Analyze application usage
• Identify suspicious outbound connections
• Enhance compliance and auditing

Basic Dashboard Visualizations

These are very basics dashbaord visualization for sophos XG Firewall.

Dashboard 01

Dashboard 02

Dashboard 03

Conclusion

Integrating Sophos Firewall with Wazuh provides a powerful security monitoring solution by combining network-level visibility with SIEM analytics. With proper configuration of Syslog, decoders, and rules, organizations can significantly enhance their threat detection and incident response capabilities.